Граф коммитов

1237 Коммитов

Автор SHA1 Сообщение Дата
Matt Woodrow e579f452c1 Bug 1556489 - P8. Add CSPService::ConsultCSPForRedirect. r=mayhemer,ckerschb
We extract the code from CSPService::AsyncOnChannelRedirect so that we can use it in a follow-up change.

Differential Revision: https://phabricator.services.mozilla.com/D40965
2019-09-03 10:19:12 +10:00
Sebastian Streich 6a4c76882f Bug 1505412 - Skip CSP-Nonce check for CSP-Ro+Redirected Channels r=ckerschb
***
- Another test setup

Differential Revision: https://phabricator.services.mozilla.com/D36916

--HG--
extra : moz-landing-system : lando
2019-09-02 14:49:27 +00:00
Mark Banner 709c7ccf0c Bug 1577746 - Automatically enable more ESLint rules for dom/. r=baku
This enables:
- mozilla/no-useless-parameters
- mozilla/no-useless-run-test
- no-extra-boolean-cast
- no-unneeded-ternary

Depends on D44150

Differential Revision: https://phabricator.services.mozilla.com/D44151

--HG--
extra : moz-landing-system : lando
2019-09-02 11:23:26 +00:00
Mark Banner acd70816c6 Bug 1577746 - Enable ESLint rule dot-notation for dom/. r=baku
Depends on D44149

Differential Revision: https://phabricator.services.mozilla.com/D44150

--HG--
extra : moz-landing-system : lando
2019-09-02 11:23:05 +00:00
Mark Banner 351d147e2f Bug 1577746 - Enable ESLint rule object-shorthand for dom/. r=baku
Differential Revision: https://phabricator.services.mozilla.com/D44149

--HG--
extra : moz-landing-system : lando
2019-09-02 11:22:27 +00:00
Ehsan Akhgari 625509f19c Bug 1399803 - Consider all IPv4 loopback addresses as secure context; r=bzbarsky,dragana
Differential Revision: https://phabricator.services.mozilla.com/D43633

--HG--
extra : moz-landing-system : lando
2019-08-30 07:57:34 +00:00
Sebastian Hengst 6c326548a4 Bug 1577363 - Set dom/security/test/general/mochitest.ini as passing with fission. r=Ehsan
It got set as failing in bug 1576814 but passes after bug 1576316 added back fission-incompatible code.

Differential Revision: https://phabricator.services.mozilla.com/D44113

--HG--
extra : moz-landing-system : lando
2019-08-30 13:52:04 +00:00
Noemi Erli 178d154900 Backed out changeset 92848bd0c1e0 (bug 1561964) for dom/security android mochitest failures 2019-08-30 04:05:45 +03:00
Agi Sferro 426bf8391a Bug 1561964 - Re-enable all tests in dom/security/test on Android. r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D37488

--HG--
extra : moz-landing-system : lando
2019-08-29 16:04:14 +00:00
Paul Bone 36bed861bf Bug 1576814 - These tests are currently failing for fission r=kmag
Depends on D43571

Differential Revision: https://phabricator.services.mozilla.com/D43572

--HG--
extra : moz-landing-system : lando
2019-08-27 23:42:25 +00:00
Sebastian Streich 0fac17f172 Bug 1576039 - Adding more Time to Prevent Timeouts r=pbz
Differential Revision: https://phabricator.services.mozilla.com/D43454

--HG--
extra : moz-landing-system : lando
2019-08-26 16:41:16 +00:00
Noemi Erli 2d0fff3267 Backed out changeset 4bedbc45e231 (bug 1505412) for failures in test_bug1505412.html CLOSED TREE 2019-08-22 19:52:49 +03:00
Sebastian Streich 140ba11647 Bug 1536058 - Add a Test for cache isolation r=ckerschb,Ehsan
***
Adding Ehsans nits
***

Differential Revision: https://phabricator.services.mozilla.com/D40613

--HG--
extra : moz-landing-system : lando
2019-08-22 15:21:09 +00:00
Sebastian Streich 5c3cba344d Bug 1505412 - Skip CSP-Nonce check for CSP-Ro+Redirected Channels r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D36916

--HG--
extra : moz-landing-system : lando
2019-08-22 15:23:17 +00:00
Andrew McCreight ee73cb534e Bug 1575343, part 2 - Avoid string copies when getting calling location in nsCSPContext. r=smaug
This code grabs the URI, then tries to overwrite it with information
from GetCallingLocation, then possibly overwrites it again with the
original information, then converts the string.

My patch reorders things so that we try GetCallingLocation() first, so
we only set the values once. In the case where GetCallingLocation()
succeeds it avoids a string copy from 8 to 16 bit.

Differential Revision: https://phabricator.services.mozilla.com/D42728

--HG--
extra : moz-landing-system : lando
2019-08-20 22:53:53 +00:00
Andrew McCreight 62bd52a17f Bug 1575343, part 1 - Avoid a gratuitous string copy by calling the nsAString overload of GetCallingLocation. r=smaug
The nsAString overload of GetCallingLocation directly converts the
original source file name string into an nsAString. A number of
callers that want the source file name in an nsAString are calling the
nsACString overload of GetCallingLocation, then calling
NS_ConvertUTF8toUTF16. This results in an extra intermediate copy of
the original string data.

Differential Revision: https://phabricator.services.mozilla.com/D42727

--HG--
extra : moz-landing-system : lando
2019-08-20 22:53:49 +00:00
Thomas Nguyen cf20303f06 Bug 1528697 - Remove ReferrerPolicy.h and add utils to ReferrerInfo r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D41956

--HG--
extra : moz-landing-system : lando
2019-08-21 12:09:06 +00:00
Thomas Nguyen bbd6f51a56 Bug 1528697 - Add cenum referrerpolicy in ReferrerInfo.idl r=ckerschb,Gijs
Differential Revision: https://phabricator.services.mozilla.com/D41955

--HG--
extra : moz-landing-system : lando
2019-08-21 13:28:23 +00:00
Thomas Nguyen 32ab8293ff Bug 1528697 - Expose ReferrerPolicy.webidl and use referrerpolicy enum r=smaug
ReferrerPolicy gets tossed back and forth as a uint32_t and
ReferrerPolicy enum in header file. Expose ReferrerPolicyValues from
webidl file and use consistently in native code.

Differential Revision: https://phabricator.services.mozilla.com/D41954

--HG--
extra : moz-landing-system : lando
2019-08-21 13:24:45 +00:00
Thomas Nguyen fe6a6a4285 Bug 1567940 Apply ReferrerInfo to Download and fix Go to Download Page button r=Gijs,dimi
In the old way, if referrer is ommited we will not be able to go to
download page. In that case, we should use originalReferrer in
ReferrerInfo object

Differential Revision: https://phabricator.services.mozilla.com/D39875

--HG--
extra : moz-landing-system : lando
2019-08-20 16:22:44 +00:00
Daniel Varga 952e8654d9 Backed out changeset 983ff93a11ad (bug 1505412) for debug-test-verify-e10s failure at dom/security/test/csp/test_bug1505412.html. On a CLOSED TREE 2019-08-16 13:19:32 +03:00
Sebastian Streich 645ecf6d90 Bug 1505412 - Skip CSP-Nonce check for CSP-Ro+Redirected Channels r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D36916

--HG--
extra : moz-landing-system : lando
2019-08-15 15:51:33 +00:00
Bogdan Tara 745a1d73ea Merge mozilla-central to mozilla-inbound. a=merge CLOSED TREE 2019-08-15 01:06:23 +03:00
Tom Ritter 097aa52411 Bug 1573622 - Do not enforce eval() assertions if userchrome.css is enabled r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D41814

--HG--
extra : moz-landing-system : lando
2019-08-14 14:29:57 +00:00
Sebastian Streich d9aecc626c Bug 1570658 - Add a Flag for Navigation-Nosniff r=ckerschb
***
Revert Changes to Test

Differential Revision: https://phabricator.services.mozilla.com/D40618

--HG--
extra : moz-landing-system : lando
2019-08-14 07:07:33 +00:00
Christoph Kerschbaumer f5df74c740 Bug 1573145: Create ContentSecurityUtils.h/cpp and move AssertAboutPageHasCSP into it. r=jkt
Differential Revision: https://phabricator.services.mozilla.com/D41537

--HG--
extra : moz-landing-system : lando
2019-08-14 10:15:09 +00:00
Jan Andre Ikenmeyer e92e3d02f6 Bug 1560699 - Download FTP resources instead of rendering them. r=michal
Differential Revision: https://phabricator.services.mozilla.com/D39702

--HG--
extra : moz-landing-system : lando
2019-08-11 20:46:06 +00:00
Andrew McCreight c706a636a8 Bug 1559489, part 4 - Remote-to-local window transplanting. r=tcampbell,bzbarsky
This patch cleans up remote outer window proxies when we navigate back
into the process.

It adds a flag to mDanglingRemoteOuterProxies that is set in between
BrowsingContext::SetDocShell(), where we can tell that the browsing
context is going from being remote to being local, to
nsGlobalWindowOuter::SetNewDocument(), where the local outer window
proxy is actually created. Once the outer window is created, the
remote window proxies can be cleaned up in
CleanUpDanglingRemoteOuterWindowProxies().

The clean up is done by a process that is similar to object
transplanting, except that instead of looking in the cross-compartment
wrapper table for each compartment to find objects to be turned into
CCWs to the new object, it looks in the remote proxy map for each
compartment. SpiderMonkey doesn't know about the proxy maps, so this
has to be done by a new callback object CompartmentTransplantCallback.

Now that this cleanup is being done, it shouldn't be possible to wrap
a remote outer window proxy when the browsing context is local, so
MaybeWrapWindowProxy() can be simplified. I had to drop the assert
here that the browsing context has a window proxy because during clean
up we call wrap on a local outer window proxy before the BC gets the
window proxy set on it. I had the assert because my original plan was
to implicitly fix remote proxies during wrapping, but that is no
longer necessary.

Differential Revision: https://phabricator.services.mozilla.com/D38343

--HG--
extra : moz-landing-system : lando
2019-08-13 19:09:59 +00:00
Sebastian Streich abdca609f0 Bug 1567059 - Add test for CSP and Bookmarklet interaction r=ckerschb,bzbarsky
Differential Revision: https://phabricator.services.mozilla.com/D40652

--HG--
extra : moz-landing-system : lando
2019-08-06 19:44:05 +00:00
Christoph Kerschbaumer c515db9854 Bug 1573134: Inline evalAllowList within AssertEvalNotRestricted. r=jkt
Differential Revision: https://phabricator.services.mozilla.com/D41529

--HG--
extra : moz-landing-system : lando
2019-08-13 11:59:11 +00:00
Cosmin Sabou f134fff740 Bug 1571698 - Annotate tests that also crash on opt builds. r=kmag
Differential Revision: https://phabricator.services.mozilla.com/D41459

--HG--
extra : moz-landing-system : lando
2019-08-10 00:45:51 +00:00
Kannan Vijayan e53a880b1c Bug 1569262 - Rename nsIDocShellTreeItem::GetRootTreeItem to GetInProcessRootTreeItem for Fission marking. r=nika
Differential Revision: https://phabricator.services.mozilla.com/D41064

--HG--
extra : moz-landing-system : lando
2019-08-07 19:24:00 +00:00
Tom Ritter 95fbdde774 Bug 1572153 - Fix recording of Telemetry Events for Eval Usage r=chutten
Differential Revision: https://phabricator.services.mozilla.com/D41045

--HG--
extra : moz-landing-system : lando
2019-08-07 16:55:22 +00:00
Birunthan Mohanathas c561f0a0ae Bug 1376309 - Allow localhost ws:// connections from secure origins. r=jkt
We already allow HTTPS origins to use to plain HTTP active content when using
loopback URLs such as http://127.0.0.1. Lets extend this to WebSocket
connections as well to match Chrome.

Differential Revision: https://phabricator.services.mozilla.com/D38290

--HG--
extra : moz-landing-system : lando
2019-08-07 00:19:59 +00:00
Andreea Pavel 8f56db01f7 Backed out changeset d0aae34d9b95 (bug 1529068) for failing form-redirected-blocked.sub.html on a CLOSED TREE
--HG--
extra : rebase_source : 4d7a73e1f40de001031c61fba240c57961a902d8
2019-08-07 01:39:29 +03:00
Benjamin 455d7a7789 Bug 1529068 - navigate-to r=ckerschb,mccr8
Implementation of the navigate-to CSP directive as defined in CSP Level 3, https://www.w3.org/TR/CSP3/#directive-navigate-to

Differential Revision: https://phabricator.services.mozilla.com/D37139

--HG--
extra : moz-landing-system : lando
2019-08-06 18:27:45 +00:00
Tom Ritter 20c32a0175 Bug 1570738 - Record Telemetry if eval() is used in the Parent Process r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D40332

--HG--
extra : moz-landing-system : lando
2019-08-06 19:56:23 +00:00
Mihai Alexandru Michis 4bcc3ac00a Backed out changeset 8de4baa1dee3 (bug 1570658) for causing mochitest failures. CLOSED TREE 2019-08-06 14:19:31 +03:00
Sebastian Streich 6f2b641d45 Bug 1570658 - Add a Flag for Navigation-Nosniff r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D40618

--HG--
extra : moz-landing-system : lando
2019-08-05 14:58:13 +00:00
Emilio Cobos Álvarez 6da1e7506f Bug 1499000 - Make CORS use the right security flags to check whether an URL can be loaded. r=ckerschb
This fixes at least part of the problem. Without this patch, some of the flags
may get lost, like the ALLOW_CHROME flag which controls whether stuff like
resource:// URLs can be loaded or not.

Differential Revision: https://phabricator.services.mozilla.com/D40633

--HG--
extra : moz-landing-system : lando
2019-08-05 19:28:00 +00:00
Nicholas Nethercote dd63fcde4e Bug 1570212 - Convert dom.securecontext.whitelist_onions to a static pref. r=mccr8
Differential Revision: https://phabricator.services.mozilla.com/D40160

--HG--
extra : moz-landing-system : lando
2019-08-02 11:59:06 +00:00
Tom Ritter 0b9efb84de Bug 1567623 - Add Event Telemetry for cases where eval is triggered as System Principal r=chutten,bzbarsky,tcampbell
Differential Revision: https://phabricator.services.mozilla.com/D39559

--HG--
extra : moz-landing-system : lando
2019-08-01 20:45:31 +00:00
Tom Ritter ef67c0b08b Bug 1567623 - Update AssertEvalNotUsingSystemPrincipal and re-enable it r=ckerschb
We now correctly handle the following cases:
 - Thunderbird
 - the Browser Toolbox/Console
 - Two safe and common idioms
 - when general.config.filename is set and userChromeJS does shenanigans

We also change the function to only crash in Debug mode, and for Release channels
we report diagnostic information in a way that does not reveal user data.

Differential Revision: https://phabricator.services.mozilla.com/D39557

--HG--
extra : moz-landing-system : lando
2019-08-01 20:45:01 +00:00
Tom Ritter 88465c445c Bug 1567623 - Rename whitelist to allowlist r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D39556

--HG--
extra : moz-landing-system : lando
2019-08-01 20:44:42 +00:00
Tom Ritter 255fd27415 Bug 1567623 - Change doContentSecurityCheck logging from Debug to Verbose r=ckerschb
They are too frequent and too verbose to see any other logging statements.

Differential Revision: https://phabricator.services.mozilla.com/D39555

--HG--
extra : moz-landing-system : lando
2019-08-01 20:44:38 +00:00
Kris Maglione d7c7e749a4 Bug 1569832: Part 0 - Update crash annotations one last time. r=mccr8
Differential Revision: https://phabricator.services.mozilla.com/D40096

--HG--
extra : moz-landing-system : lando
2019-08-01 00:53:25 +00:00
Sebastian Streich 6917b697b8 Bug 1428473 Support X-Content-Type-Options: nosniff when navigating r=ckerschb,dragana,alchen
***
Apply Requested Revision

Differential Revision: https://phabricator.services.mozilla.com/D33959

--HG--
extra : moz-landing-system : lando
2019-07-31 16:59:53 +00:00
Tom Schuster af8f619ad2 Bug 1558915 - Use infallible nsIURI::SchemeIs in dom/security. r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D39779

--HG--
extra : moz-landing-system : lando
2019-07-30 07:23:18 +00:00
Christoph Kerschbaumer ad40847192 Bug 1567877: Apply Meta CSP to about:devtools-toolbox. r=jdescottes,Ehsan
Differential Revision: https://phabricator.services.mozilla.com/D39328

--HG--
extra : moz-landing-system : lando
2019-07-30 07:14:09 +00:00
Thomas Nguyen 2bfaa83f89 Bug 1567573 - Apply Referrer-Policy header from redirect response r=michal
Differential Revision: https://phabricator.services.mozilla.com/D38879

--HG--
extra : moz-landing-system : lando
2019-07-29 13:51:17 +00:00